ctf-pwn
ctf pwn
What it does
- pwndbg — Linux: GitHub, macOS: brew install pwndbg/tap/pwndbg-gdb
- checksec — included with pwntools
- field-notes.md - Detailed pwn notes: heap exploitation quick reference, additional exploit notes, useful commands
- If you do not yet understand what the binary does, switch to /ctf-reverse before trying to exploit it.
- If the service is really a restricted shell, encoding puzzle, or sandbox language challenge, switch to /ctf-misc.
- If the exploit path depends on a web endpoint, session bug, or upload primitive more than memory corruption, switch to /ctf-web.
- If the vulnerability requires breaking a cryptographic primitive before exploitation, switch to /ctf-crypto.
Requirements & configuration
- If the exploit path depends on a web endpoint, session bug, or upload primitive more than memory corruption, switch to /ctf-web.
- If the vulnerability requires breaking a cryptographic primitive before exploitation, switch to /ctf-crypto.
- | RELRO | Full | GOT is read-only - need alternative targets (hooks, vtables, return addr) |
- | Canary | Present | Stack smash detected - need leak or avoid stack overflow (use heap) |
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
ctf-pwn FAQ
What does the ctf-pwn skill do?
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges. pwndbg — Linux: GitHub, macOS: brew install pwndbg/tap/pwndbg-gdb checksec — included with pwntools
What does ctf-pwn require?
If the exploit path depends on a web endpoint, session bug, or upload primitive more than memory corruption, switch to /ctf-web. If the vulnerability requires breaking a cryptographic primitive before exploitation, switch to /ctf-crypto. | RELRO | Full | GOT is read-only - need alternative targets (hooks, vtables, return addr) | | Canary | Present | Stack smash detected - need leak or avoid stack overflow (use heap) |
How do I install ctf-pwn?
Run: npx -y skills add https://github.com/ljagiello/ctf-skills --skill ctf-pwn --agent claude-code — the source lives at github.com/ljagiello/ctf-skills.
Maintain ctf-pwn?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/ljagiello-ctf-skills-ctf-pwn?ref=badge) npx agentictools info skills/ljagiello-ctf-skills-ctf-pwn The second line is the CLI lookup for this page — handy in READMEs and docs.
